Security Headers Generator
Generate HTTP security headers for your web application: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Copy the configuration directly into your server, CDN, or reverse proxy.
HTTP Security Headers for Web Application Hardening
Content-Security-Policy (CSP) controls which resources the browser can load, preventing XSS and data injection attacks. Strict-Transport-Security (HSTS) forces HTTPS connections. X-Frame-Options prevents clickjacking by controlling iframe embedding. X-Content-Type-Options prevents MIME type sniffing. Referrer-Policy controls what referrer information is sent. Permissions-Policy restricts access to browser APIs like camera and geolocation.
Deployment Notes
- Add these headers to your web server (Nginx, Apache), CDN (Cloudflare, Akamai), or application framework
- Test with securityheaders.com for a letter grade
- Start with relaxed CSP policies and gradually tighten them